> ## Documentation Index
> Fetch the complete documentation index at: https://magic-post.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, use and revoke the keys that let your own scripts and tools read your posts and channels and line up new posts.

An API key lets a script or a tool such as Zapier talk to your MagicPost account without signing in. A key can read your account, channels, posts and analytics, and, if you allow it, create and remove posts. The calls are listed in the [REST API reference](https://magic-post.mintlify.site/account/rest-api.md).

## Before you start

API access is a plan feature called **API and webhooks**. If your plan does not include it, the API keys page shows a locked panel. The page says that your keys are kept and can be revoked, but requests made with them are turned away until your plan includes API and webhooks again.

When the site runs without SaaS billing, API access is not restricted by plan. See [SaaS overview](https://magic-post.mintlify.site/saas/overview.md).

## Create a key

**1. Open API keys**

Click your name at the bottom of the sidebar, then click **API keys** (`/app/settings/api`).

**2. Name the key**

Under **Make a key**, enter a **Name** so you remember what the key is for, for example the tool that will use it. The name can be up to 80 characters.

**3. Choose how long it lasts**

Pick a value in **Lasts**: **30 days**, **90 days**, **365 days** or **Until revoked**. The default is 90 days.

**4. Decide whether it can write**

Tick **Can also create and remove posts** if the key needs to create or delete posts. Without it, the key can only read.

**5. Make the key**

Click **Make the key**.

**6. Copy it now**

MagicPost shows **Your new key** once. Click **Copy**, store it somewhere safe, then click **Done**.

> [!WARNING]
>
> The key is shown once. MagicPost keeps only a hash of it, so nobody, including your administrator, can show it to you again. If you lose it, revoke it and make another.

A key starts with `mp_` followed by 40 random characters.

You can have up to 10 keys. When you reach that number, the form is disabled until you revoke one.

## What a key can do

| Ability | Shown as | Allows |
| - | - | - |
| Read | **Read only** | Every `GET` request: account, channels, analytics and posts |
| Write | **Read and write** | Everything above, plus creating and deleting posts |

Posts created through a key are checked like posts made in the composer. They count towards your plan's limits, such as posts per month and posts scheduled ahead, and they follow your team's approval rules. See [Composer](https://magic-post.mintlify.site/user-guide/composer.md).

## Your keys

The **Your keys** list shows, for each key:

* the name and a **Read only** or **Read and write** tag,
* an **Expired** tag when the expiry date has passed,
* the last four characters, as `mp_…` followed by those characters, so you can tell keys apart,
* when it was last used, or **never used**,
* when it expires, or **does not expire**.

An expired key stops working. Make a new one to replace it.

## Revoke a key

**1. Find the key**

Open **API keys** and locate the key in **Your keys**.

**2. Revoke it**

Click **Revoke**, then confirm **Revoke this key?**.

Anything that uses the key stops working straight away. You cannot undo a revocation.

## Use a key

Send the key as a bearer token in the `Authorization` header. A key can make up to 60 requests a minute.

```bash theme={null}
curl https://your-site.example/api/v1/channels \
  -H "Authorization: Bearer mp_your_key" \
  -H "Accept: application/json"
```

Replace `your-site.example` with the address of your MagicPost site. The API keys page prints examples with your real address.

## Troubleshooting

> [accordion] Make the key is disabled
>
> Either your plan does not include API and webhooks, or you already have 10 keys. The page shows which one applies. Revoke a key you no longer use, or ask your administrator about your plan.

> [accordion] 401: A valid API key is needed. Send it as a bearer token.
>
> The key is missing, mistyped, revoked or expired. Check the header, and check the key's tag in **Your keys**.

> [accordion] 403: This API key can only read. Make a key that can also write.
>
> You called `POST` or `DELETE` with a read-only key. Make a key with **Can also create and remove posts** ticked.

> [accordion] 403: API and webhooks is not part of your plan.
>
> Your plan does not include the feature. Upgrade your plan, or ask your administrator. See [Billing and subscription](https://magic-post.mintlify.site/account/billing.md).

> [card] [REST API reference](https://magic-post.mintlify.site/account/rest-api.md)
>
> Every endpoint, with request and response examples.

> [card] [Webhooks](https://magic-post.mintlify.site/account/webhooks.md)
>
> Get events pushed to your own address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.